Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04-11-2022 17:20
Behavioral task
behavioral1
Sample
9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe
Resource
win10v2004-20220812-en
General
-
Target
9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe
-
Size
7KB
-
MD5
e598e5ae61f73fb6b3883f6e79f05916
-
SHA1
84063d5808f58c73871f8acea020f6a3e2382a30
-
SHA256
9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63
-
SHA512
95504ea38a2aac269fc2577d5c7e607010f10005adf52316f9e894edae8e2b043355ec7645de4a1abeb3268f68cb36734a74b0edd827ed67ec72e9e09463753f
-
SSDEEP
96:sgjZhl8wdS+r3yOYW189fTwUVF0CWHyjk8P1LOmjXfihExTC+YbT9bOvuKN+gLJB:1jzdrr1FG1WDCgmjPZTCxv97HDMUA
Malware Config
Signatures
-
Detected Xorist Ransomware 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4632-132-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist behavioral2/memory/4632-133-0x0000000000400000-0x000000000040C000-memory.dmp family_xorist -
Xorist Ransomware
Xorist is a ransomware first seen in 2020.
-
Drops file in Drivers directory 8 IoCs
Processes:
9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exedescription ioc process File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe -
Processes:
resource yara_rule behavioral2/memory/4632-132-0x0000000000400000-0x000000000040C000-memory.dmp upx behavioral2/memory/4632-133-0x0000000000400000-0x000000000040C000-memory.dmp upx -
Drops startup file 1 IoCs
Processes:
9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6J1IMrImAiEKru9.exe" 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe -
Drops file in System32 directory 64 IoCs
Processes:
9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exedescription ioc process File opened for modification C:\Windows\System32\DriverStore\FileRepository\usbcir.inf_amd64_a19f675674962ae4\CIRCoInst.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\dsparse.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\SysWOW64\InstallShield\setupdir\0015\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\EdgeManager.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\SysWOW64\es-ES\Licenses\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\Nlsdl.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\wpnclient.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\IMEPADSM.DLL 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\mstask.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\rundll32.exe 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\mfc120deu.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\WindowsFeatureSet\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\fontsub.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\HeatCore.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\KBDPL1.DLL 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\SndVolSSO.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\System32\DriverStore\FileRepository\xusb22.inf_amd64_d0f2fd4c931f4672\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\wbem\WmiApRpl.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmgen.inf_amd64_977aa23dfab87f15\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_x86_c62e9f8067f98247\I386\UNIDRVUI.DLL 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\System32\DriverStore\FileRepository\wnetvsc_vfpp.inf_amd64_9ce6f68c11eede58\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\System32\DriverStore\FileRepository\netevbda.inf_amd64_1503f4d5a0d6ba56\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\System32\DriverStore\FileRepository\wvmic_shutdown.inf_amd64_bce6891915e70bbf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\odpdx32.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\odbccp32.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\setup\msdtcstp.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\cscapi.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\Dism\ProvProvider.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\downlevel\api-ms-win-crt-private-l1-1-0.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\System32\DriverStore\FileRepository\digitalmediadevice.inf_amd64_5b64b65052c3a32a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\easwrt.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\webservices.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\tokenbinding.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_RoleResource\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\wshunix.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmmts.inf_amd64_bc07e137c52c529a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\System32\DriverStore\FileRepository\rdpbus.inf_amd64_05ebd3b4422f62ba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\msvfw32.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\cmgrcspps.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\smartscreenps.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\SysWOW64\wbem\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\ja\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\autochk.exe 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\directml.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\DMAlertListener.ProxyStub.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\downlevel\api-ms-win-core-fibers-l1-1-1.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\nshwfp.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\odbccu32.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\MsCtfMonitor.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\MUI\0C0A\mscorees.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\packager.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ArchiveResource\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\dimsroam.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\SysWOW64\F12\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\nshipsec.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\wbem\msdtcwmi.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\Windows.Media.FaceAnalysis.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_LogResource\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\IME\SHARED\imecfm.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\msfeedsbs.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\nlmgp.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\mfc120jpn.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SysWOW64\cewmdm.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe -
Drops file in Program Files directory 64 IoCs
Processes:
9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exedescription ioc process File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppPackageBadgeLogo.scale-200_contrast-black.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosSmallTile.contrast-black_scale-200.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.scale-125.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\hr-hr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Assets\CalculatorMedTile.contrast-white_scale-200.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\Square310x310Logo.scale-100.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-80_contrast-white.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-20_altform-unplated.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.2.2_2.2.27328.0_x64__8wekyb3d8bbwe\mrt100_app.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-48_altform-unplated_contrast-black.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-256.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Program Files\VideoLAN\VLC\lua\extensions\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Place\contrast-white\WideTile.scale-100.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-black_scale-200.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraSplashScreen.contrast-black_scale-125.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxA-Advanced-Dark.scale-250.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\core_icons.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_transcode_plugin.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-32_altform-lightunplated.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\jp2native.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\Microsoft.Graphics.Canvas.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_highcontrast_retina.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-si\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ru-ru\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\de-de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\nl-nl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\osf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00_14.0.27323.0_x64__8wekyb3d8bbwe\concrt140_app.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsMedTile.contrast-white_scale-200.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-30_altform-unplated.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GFX.DLL 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_filter\libtransform_plugin.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedWideTile.scale-100_contrast-black.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-72.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\GenericMailBadge.scale-400.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\goopdateres_fil.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\access_output\libaccess_output_file_plugin.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\Assets\ScreenSketchSquare71x71Logo.scale-200_contrast-black.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailWideTile.scale-125.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\GetStartedSmallTile.scale-200_contrast-black.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\swscale-5_ms.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-256_altform-fullcolor.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\RTL\contrast-black\SmallTile.scale-100.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Xml.Linq.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Win10\StoreLogo.scale-100.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\ReactAssets\assets\RNApp\app\uwp\images\typing\bubble\black.gif 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.DataSetExtensions.Resources.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteSectionGroupSmallTile.scale-125.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Photos.Viewer.Plugins.Native.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\GenericMailBadge.scale-100.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-black\LargeTile.scale-125.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-16_contrast-white.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe -
Drops file in Windows directory 64 IoCs
Processes:
9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exedescription ioc process File created C:\Windows\WinSxS\amd64_microsoft-windows-a..c-service.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_88f39fbd621cda6b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Input.Manipulations.resources\v4.0_4.0.0.0_de_b77a5c561934e089\System.Windows.Input.Manipulations.resources.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\de\system.data.sqlxml.resources.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\fr\Microsoft.Build.Tasks.resources.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\WinSxS\amd64_dual_wdmaudio.inf_31bf3856ad364e35_10.0.19041.746_none_8cc50abfaa861487\SysFxUI.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-onecore-deviceupdatecenter-csp_31bf3856ad364e35_10.0.19041.1202_none_e35d603e7b0f54a6\DeviceUpdateCenterCsp.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\PresentationFramework.Aero2\v4.0_4.0.0.0__31bf3856ad364e35\PresentationFramework.Aero2.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\1036\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.19041.746_none_79bfc5cb57157e98\r\LocationWinPalMisc.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..ients-svc.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_a22d4db313525670\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-hyper-v-drivers-hypervisor_31bf3856ad364e35_10.0.19041.264_none_0e32f443c4669fed\r\hvix64.exe 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-http.resources_31bf3856ad364e35_10.0.19041.1_de-de_1ff5905086c51169\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-l..omhandler.resources_31bf3856ad364e35_10.0.19041.1_de-de_4fe760915b8fb25f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Management.Infrastructure.Resources\v4.0_1.0.0.0_it_31bf3856ad364e35\Microsoft.Management.Infrastructure.Resources.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\Microsoft.Data.Entity.Build.Tasks.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SystemResources\Windows.UI.Search\Images\logo.contrast-black_scale-80.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\WinSxS\amd64_dual_prnms012.inf_31bf3856ad364e35_10.0.19041.1_none_a3feabb281faa7e4\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\WinSxS\amd64_hyperv-virtio_31bf3856ad364e35_10.0.19041.928_none_353d3d5427d43fb8\r\vmvirtio.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ion-mfcaptureengine_31bf3856ad364e35_10.0.19041.906_none_ca9fe18cfc715c42\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-n..tion_service_iasnap_31bf3856ad364e35_10.0.19041.1_none_2f6bce0df481ff63\iasnap.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\1031\vbc7ui.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SystemApps\microsoft.windows.narratorquickstart_8wekyb3d8bbwe\assets\NarratorUWPSquare44x44Logo.targetsize-48_altform-unplated.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..ntrolpanel.appxmain_31bf3856ad364e35_10.0.19041.1202_none_8f7e37524c3e1a13\TileSmall.contrast-white_scale-400.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..dlinetool.resources_31bf3856ad364e35_10.0.19041.1_it-it_c4cad365b837612e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-microsoftedge_31bf3856ad364e35_10.0.19041.264_none_ef195f564f00d259\Square150x150Logo.scale-125.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\ES\Microsoft.VisualBasic.resources.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\fr\XsdBuildTask.resources.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\SystemApps\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\core\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy\speech\0410\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..-counters.resources_31bf3856ad364e35_10.0.19041.1_de-de_f7974574dade5511\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\WinSxS\amd64_dc1-controller.inf.resources_31bf3856ad364e35_10.0.19041.610_en-us_50581d2c454a61af\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\WinSxS\amd64_ipoib6x.inf.resources_31bf3856ad364e35_10.0.19041.1_es-es_b5d503a2b3e27a44\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\assembly\GAC_MSIL\PresentationUI.Resources\3.0.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.P08ac43d5#\c22867030e5bfe64cd2f01ea2a121306\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.ServiceModel.Discovery.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-b..ndactivitymoderator_31bf3856ad364e35_10.0.19041.1_none_8b4593ccb753f4e5\BamSettingsClient.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-m..namespace-downlevel_31bf3856ad364e35_10.0.19041.1_none_7d55e8342077d456\api-ms-win-core-sysinfo-l1-1-0.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..ty-backcompat-tlb28_31bf3856ad364e35_10.0.19041.1_none_67b8a0001d6daa67\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-mccs-aphostservice_31bf3856ad364e35_10.0.19041.746_none_33374e3aacb7c6e6\r\APHostService.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..-warp-jitexecutable_31bf3856ad364e35_10.0.19041.1_none_83ab1c56c187ef65\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..serverapi.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d658b86d647b1026\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_10.0.19041.1_es-es_12451df02dbd2879\403-17.htm 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ie-feeds-platform_31bf3856ad364e35_11.0.19041.1081_none_187c84191909cd57\f\msfeeds.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-ie-htmlrendering_31bf3856ad364e35_11.0.19041.1165_none_cbcbe0c900c7339c\r\edgehtml.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-mtf_31bf3856ad364e35_10.0.19041.1_none_5e7425adfabb084c\MTF.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Workflow.Runtime.resources\v4.0_4.0.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\es-ES\assets\ErrorPages\PhishSite_Iframe.htm 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\WinSxS\amd64_dual_wvpci.inf_31bf3856ad364e35_10.0.19041.1_none_1f444c4add774c0c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-fontext_31bf3856ad364e35_10.0.19041.423_none_7c917c97525f1487\f\fontext.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..rolviewer.resources_31bf3856ad364e35_11.0.19041.1_de-de_e365cb47d7f752c9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.19041.1266_none_b2317523477fbd48\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mpg4decd_31bf3856ad364e35_10.0.19041.1165_none_d57648831732f137\r\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-c..ngshellapp.appxmain_31bf3856ad364e35_10.0.19041.84_none_24f8aafdaceaf0b5\square150x150logo.scale-125.png 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..le-server.resources_31bf3856ad364e35_10.0.19041.1_ja-jp_d34d00a50f6f11b1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEHost.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-apprep-chxapp.appxmain_31bf3856ad364e35_10.0.19041.423_none_15f557c171018574\f\CHXSmartScreen.exe 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ie-iechooser.resources_31bf3856ad364e35_11.0.19041.1_it-it_323e942ef84693b2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File opened for modification C:\Windows\WinSxS\amd64_microsoft-windows-iis-aspbinaries_31bf3856ad364e35_10.0.19041.906_none_6aa8dc8fc623977c\asp.dll 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\fr-FR\assets\ErrorPages\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..nese-eacommonapijpn_31bf3856ad364e35_10.0.19041.746_none_6fecf6012ef3141e\f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..t-onecore.resources_31bf3856ad364e35_10.0.19041.1_en-us_9459bc7bcfac64cd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-n..ider-infrastructure_31bf3856ad364e35_10.0.19041.546_none_8a1687c8ee003137\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe -
Modifies registry class 10 IoCs
Processes:
9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.CrySpheRe 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.CrySpheRe\ = "RYAGHXYNWJVCEJA" 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\RYAGHXYNWJVCEJA\ = "CRYPTED!" 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\RYAGHXYNWJVCEJA\DefaultIcon 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\RYAGHXYNWJVCEJA\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6J1IMrImAiEKru9.exe,0" 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\RYAGHXYNWJVCEJA\shell 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\RYAGHXYNWJVCEJA\shell\open 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\RYAGHXYNWJVCEJA 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\RYAGHXYNWJVCEJA\shell\open\command 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\RYAGHXYNWJVCEJA\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6J1IMrImAiEKru9.exe" 9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe"C:\Users\Admin\AppData\Local\Temp\9680ddca296d16b58ceb381308e58509d73eafbf92d884b4a5865dcb843c0a63.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:4632